From patchwork Fri Jul 17 19:23:22 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Dykstra X-Patchwork-Id: 29934 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@bilbo.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from ozlabs.org (ozlabs.org [203.10.76.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mx.ozlabs.org", Issuer "CA Cert Signing Authority" (verified OK)) by bilbo.ozlabs.org (Postfix) with ESMTPS id B7DEDB7089 for ; Sat, 18 Jul 2009 05:23:36 +1000 (EST) Received: by ozlabs.org (Postfix) id AE70EDDD1B; Sat, 18 Jul 2009 05:23:36 +1000 (EST) Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 402E3DDD0C for ; Sat, 18 Jul 2009 05:23:36 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752049AbZGQTX1 (ORCPT ); Fri, 17 Jul 2009 15:23:27 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752046AbZGQTX1 (ORCPT ); Fri, 17 Jul 2009 15:23:27 -0400 Received: from mail-px0-f185.google.com ([209.85.216.185]:41717 "EHLO mail-px0-f185.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752027AbZGQTX0 (ORCPT ); Fri, 17 Jul 2009 15:23:26 -0400 Received: by pxi15 with SMTP id 15so718736pxi.33 for ; Fri, 17 Jul 2009 12:23:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:subject:from:to:cc :in-reply-to:references:content-type:date:message-id:mime-version :x-mailer:content-transfer-encoding; bh=8k7AcTMuWFf9BesLo28pwZIuje3ItFD2PKy1mIVzij8=; b=vqewHLcmpHUywhQzJa8SS9WJi9qq4WCZ0UMk8zcA+MCH5MsgOdCg2MIukf76QDLuF6 6gF404iwoiaHjKDLKxfahGMX1nY+UEEKjfeE5iqRlQlgtWmVVysdZoS/U/dSMQ377o9u U4Vqma5zbP6V9hC84R7uolGurwvJaLKAEYYnY= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=subject:from:to:cc:in-reply-to:references:content-type:date :message-id:mime-version:x-mailer:content-transfer-encoding; b=TJzNvf7IaWrGhdPAsiM6ERxBxQrqiBUBzy1GaYv87FlZRJ4n7Ev2npUGMc2iiHXFcE XFzMYW0te26X5Ffy0TXaaEAgMUAexKbFOeAm3FM9+R5WOsVho/Lgbvu848aHmMY8VhqN 7YqWDRygdEVLDnR/eYOqI+VQaoqlMWDxI4HLk= Received: by 10.114.61.1 with SMTP id j1mr2036263waa.207.1247858606721; Fri, 17 Jul 2009 12:23:26 -0700 (PDT) Received: from ?192.168.221.201? ([24.118.80.156]) by mx.google.com with ESMTPS id k37sm3439941waf.42.2009.07.17.12.23.24 (version=TLSv1/SSLv3 cipher=RC4-MD5); Fri, 17 Jul 2009 12:23:25 -0700 (PDT) Subject: [PATCH] tcp: Use correct peer adr when copying MD5 keys (WAS: [PATCHv2] tcp: Fix MD5 signature checking on IPv4 mapped sockets) From: John Dykstra To: Stephen Hemminger Cc: netdev , Adam Langley , YOSHIFUJI Hideaki In-Reply-To: <20090716113652.65dd1c8d@nehalam> References: <1247756691.7627.5.camel@Maple> <20090716113652.65dd1c8d@nehalam> Date: Fri, 17 Jul 2009 19:23:22 +0000 Message-Id: <1247858602.8509.7.camel@Maple> Mime-Version: 1.0 X-Mailer: Evolution 2.22.3.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Thu, 2009-07-16 at 11:36 -0700, Stephen Hemminger wrote: > On Thu, 16 Jul 2009 10:04:51 -0500 > John Dykstra wrote: > > > This revision to the patch removes a misplaced > > blank line. > > > > --- > > Fix MD5 signature checking so that an IPv4 active open > > to an IPv6 socket can succeed. In particular, use the > > correct address family's signature generation function > > for the SYN/ACK. > > > > Reported-by: Stephen Hemminger > > Signed-off-by: John Dykstra > > This fixes the syn-ack, but data does not flow. The following patch is _in addition_ to the one I sent out yesterday. Since they are independent, and fix different bugs, I'm leaving them separate. I guess it's clear not many people are running authenticated BGP sessions on Linux... --- [PATCH] tcp: Use correct peer adr when copying MD5 keys When the TCP connection handshake completes on the passive side, a variety of state must be set up in the "child" sock, including the key if MD5 authentication is being used. Fix TCP for both address families to label the key with the peer's destination address, rather than the address from the listening sock, which is usually the wildcard. Reported-by: Stephen Hemminger Signed-off-by: John Dykstra --- net/ipv4/tcp_ipv4.c | 2 +- net/ipv6/tcp_ipv6.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 7c107eb..6d88219 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1374,7 +1374,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb, */ char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC); if (newkey != NULL) - tcp_v4_md5_do_add(newsk, inet_sk(sk)->daddr, + tcp_v4_md5_do_add(newsk, newinet->daddr, newkey, key->keylen); newsk->sk_route_caps &= ~NETIF_F_GSO_MASK; } diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index ae3d657..d849dd5 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1442,7 +1442,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb, */ char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC); if (newkey != NULL) - tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr, + tcp_v6_md5_do_add(newsk, &newnp->daddr, newkey, key->keylen); } #endif